Privacy policy

ClassFactor is operated by First Capital Merchant Solutions, Inc., a Florida corporation doing business as ClassFactor (“ClassFactor”, “we”, “us”, or “our”). Our postal address is 10001 NW 50th St, Ste 114, Sunrise, FL 33351-8087, USA, and you can reach us at support@classfactor.com.

ClassFactor is an AI study platform. You add your own study material — documents, slides, spreadsheets, text, images, audio and video files, recordings, web pages, Google Docs, YouTube links, and Anki decks — and ClassFactor turns it into flashcards, quizzes, timed exams, notes, and guided lessons. It also offers an AI tutor (by text or voice call), an AI Study Coach, read-aloud audio, spaced-repetition review scheduling, streaks and a leaderboard, sharing links, and notifications.

This policy applies to our website at www.classfactor.com, our web app at app.classfactor.com, our iOS and Android apps, the emails and notifications we send, the ClassBot help assistant on our website, and the related support channels we operate (together, the “Services”). “Personal data” means information that identifies you or can reasonably be linked to you.

For the personal data described in this policy, First Capital Merchant Solutions, Inc. is the “controller” (the business responsible for deciding how and why your data is used) under the EU and UK General Data Protection Regulation, and the “business” under California and other US state privacy laws.

This policy does not cover third-party websites, apps, or services you reach from ClassFactor — including YouTube, Google Docs, Apple, Google, or Stripe — which have their own privacy policies. It also does not cover how an employer or other organization handles information about you if it asks you to use ClassFactor; that organization’s own policies apply to its activities. If you use ClassFactor on behalf of an organization and it needs a Data Processing Addendum, it can request one by emailing support@classfactor.com.

Related documents: our Terms of Service (/terms), Cookie Policy (/cookies), Refund Policy (/refunds), Data Processing Addendum (/dpa), and list of service providers (/subprocessors).

We collect the data we need to run ClassFactor, bill for it, keep it secure, and meet our legal obligations. The rest of this policy explains the details.

Your study content is yours. We use it to provide the features you ask for. We do not use it to train our own AI models, and the AI providers we use do not use it to train theirs under their commercial API terms.

We do not sell your personal data for money. Our website and web app use advertising measurement from Meta and TikTok, which US state privacy laws treat as “sharing” for cross-context behavioral advertising or “targeted advertising”. You can turn it off at any time, it is off until you opt in outside the United States, and we honor Global Privacy Control.

Your study content never goes to advertising platforms. Advertising measurement can learn that a visit happened, or that a trial started or a subscription was paid for — never what you uploaded, what you are studying, or how you are doing.

Our mobile apps do not use advertising identifiers, do not track you across other companies’ apps, and do not use your camera, precise location, or contacts.

You can download a copy of your data and delete your account yourself, in Settings → Your data, on the web and in our apps.

You have privacy rights that depend on where you live, and you can exercise them by emailing support@classfactor.com. We will not treat you differently for doing so.

Account information. When you create an account we collect your first and last name, email address, and password. Your password is stored only in hashed form by our authentication system; we cannot read it. We also store your avatar choice, time zone, the language you want generated content in, your plan, and your referral code. We require you to verify your email address.

Age confirmation and terms acceptance. When you sign up, you confirm that you meet the age requirement (13 or older, or 16 or older in the EEA or UK, or that you have a parent’s or guardian’s permission) and that you agree to our Terms of Service and this Privacy Policy. We record that confirmation together with the version of the terms and the date and time.

Onboarding answers. When you set up your account, you can tell us about your role, what you are studying for, and your goals, so we can tailor the Services to you.

Study content. The material you upload, paste, link, or record — for example PDFs, Word, PowerPoint, and Excel files, text, images and photos, audio and video files, recordings you make in the app, web page links, Google Docs links, YouTube links, and Anki decks — along with the text we extract from it and everything the Services generate from it, such as flashcards, image-occlusion cards, quizzes, exams, notes, lessons, and lesson figures. It also includes the personal classes and folders you use to organize your material.

Study activity. Your study sessions, answers, scores, quiz and exam attempts, spaced-repetition review data, mastery estimates, streaks, XP, and levels.

AI conversations and your Study Coach profile. Your conversations with the AI tutor and the AI Study Coach, and the daily tips the Coach creates for you. If you fill in your Study Coach profile, we store what you tell us there — for example your goals, what you are studying for, your exam approach, what you struggle with, your best study time, your weekly study hours, your term goals, and, if you choose to share them, your sleep habits. All profile fields are optional.

Voice calls. If you start a voice call with the AI tutor, we store the transcript of the call and the number of call minutes used. Your microphone audio is streamed to our AI provider during the call as described in “AI processing of your content”; we do not store call recordings.

Leaderboard, blocks, and sharing. The alias shown to other learners on the leaderboard, whether you have hidden yourself from the leaderboard, the people you have blocked, and the public share links you create for decks, quizzes, notes, or lessons, along with how many times each link has been viewed.

Reports you make. If you report an AI Coach reply, shared content, or a display name, we collect the reason and any details you give. If you are not signed in, we also collect the email address you provide, and we store a salted hash of your IP address to help prevent abuse of the reporting system.

Support requests. Messages, support tickets, and attachments you send us. If you contact us without an account — for example through our website contact form or the ClassBot help assistant — we collect the name and email address you give us, your message, and your consent to be contacted about it.

Referrals you send. If you invite friends through our referral program, we collect the email addresses you enter and send each person one invitation email on your behalf. Please only invite people you know who would welcome the invitation.

Payments. When you subscribe or buy credits, we store your plan, subscription status, renewal dates, promotion codes, invoices and receipts, the customer and subscription identifiers from our payment processor, and your credit balance and history. Card and bank details are collected directly by Stripe, Apple, or Google — we never see or store your full card number.

Marketing forms. If you sign up for our newsletter, request a demo, or submit a form on our website, we collect the details you enter, such as your name, email address, and message.

Device, log, and usage data. When you use the Services, our servers record information such as your IP address, browser type and version, operating system, device model, app version, the pages and screens you use, the features you use, and the date and time. Your signed-in sessions store the IP address and browser or device description they were created from, so you and we can spot unfamiliar sign-ins.

Approximate location. Our hosting provider tells us the country your IP address is in. We use it to choose the right cookie-consent default for your region. We do not collect your precise location.

AI usage records. For each AI task we record which feature was used, how much processing it took, and what it cost us, so we can apply plan limits and credits, prevent abuse, and manage costs.

Device check when you create an account. On the sign-up screen only, we work out a short code that identifies the browser or app installation you are signing up from. On the web, your browser combines details it already makes available to every site it visits — how it draws a small test image, the name of your graphics hardware, your screen size, time zone, language, platform, and the number of processors and amount of memory — and turns them into a one-way code. Only that code reaches us; the underlying details never leave your browser, and the code cannot be turned back into them. In our mobile apps we instead generate a random identifier and store it on your device. We use it for one purpose: if an account has already been created on the same browser or app installation, we do not pay referral bonuses for the new account. It never stops you creating an account or using the Services, and we do not use it to sign you in, to build a profile about you, for analytics or advertising, or to recognise you on other websites or apps. It is stored with your account and deleted when your account is deleted.

Error reports. If something breaks, our error-monitoring provider receives details of the error, your user ID, and information about your device or browser. We do not record your screen or sessions.

Notification data. Your notification preferences, a record of which notifications we sent you, and — if you allow push notifications — the push token your device’s operating system gives us, along with your device model and operating system.

Cookies, local storage, and SDKs. Our website and web app use cookies and local storage to keep you signed in, remember your choices, protect forms against bots, and — only where you allow it — measure usage and advertising performance. Our mobile apps use software development kits (SDKs) for push notifications, error reporting, and, only if you agree in the app, analytics. See “Cookies and similar technologies” below and our Cookie Policy (/cookies).

Analytics events. Where analytics is allowed, Google Analytics (on the web) and Firebase Analytics (in the mobile apps, only after you agree in the app) receive events about how the Services are used, such as pages viewed and features opened, along with identifiers those tools assign.

Campaign attribution and advertising click identifiers. If you arrive at our website from a campaign link or an ad, and you have allowed analytics or advertising, we store the campaign parameters (such as “utm” tags), the referring page, the page you landed on, and advertising click identifiers from Meta or TikTok in a cookie. When you create an account in the web app, we save that information with your account, together with the IP address and browser description from sign-up and the advertising choice in effect at the time, and we update that choice if you change it later while using the web app. How this information is used for advertising, and how to turn it off, is described in “How we share personal data” and “Your advertising choices”.

Sign in with Google or Apple. If you choose to sign in with Google or Apple, we receive your name, email address, and an account identifier from that provider. If you use Apple’s “Hide My Email” option, we receive a private relay address instead of your real email address.

Payment and app store providers. Stripe tells us whether a web payment succeeded, and about your subscription, invoices, refunds, and disputes. Apple and Google tell us about purchases made in our iOS and Android apps — which plan was bought, transaction or purchase identifiers, and renewal, cancellation, and refund status. We do not receive your full card details from any of them.

People who invite you. If a friend invites you to ClassFactor, we receive your email address from them and use it only to send that invitation and to credit the referral if you sign up.

We do not buy personal data, and we do not receive profiles about you from advertising platforms.

We do not collect government ID numbers, your precise location, or your contacts. Our apps do not use your device’s camera. Our mobile apps do not collect advertising identifiers such as Apple’s IDFA or Google’s Advertising ID.

We do not ask for sensitive personal information such as health information, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, or biometric data, and we do not try to infer these characteristics about you.

Some study material naturally contains sensitive topics — for example, notes from a nursing course — and you may choose to add personal details of your own, such as health notes, or optional sleep habits in your Study Coach profile. That is your choice; we treat it as study content, use it only to provide the features you request, and never use it for advertising.

Please do not upload other people’s sensitive personal information, such as another person’s medical records, unless you have the right to do so. Anything you upload is processed by the AI providers described in this policy.

We use personal data for the purposes below. If you are in the European Economic Area (EEA) or the United Kingdom, data protection law requires us to have a “legal basis” for each purpose, which we list alongside it.

Providing the Services. Creating and running your account; storing and processing your study content; generating flashcards, quizzes, exams, notes, lessons, and explanations; scheduling reviews; tracking progress, streaks, XP, and the leaderboard; creating share links you ask for; and syncing across your devices. Legal basis: performance of our contract with you.

AI features you request. Sending the relevant content to AI providers to produce the output you asked for, including tutor and Coach replies, voice calls, transcription, text recognition, image generation for lesson figures, and read-aloud audio. Legal basis: performance of our contract with you.

Payments, credits, and records. Processing subscriptions and credit purchases, applying credits and plan limits, issuing receipts, handling refunds and disputes, and keeping tax and accounting records. Legal basis: performance of our contract with you, and compliance with legal obligations.

Security, fraud, and abuse prevention. Protecting accounts, verifying store purchases, checking for bots on forms and sign-in, rate limiting, enforcing usage and fair-use limits, preventing referral and refund abuse (including the sign-up device check described in “Personal data we collect automatically”), and monitoring errors. Legal basis: our legitimate interests in keeping the Services and our users safe.

Service communications. Sending account verification, security alerts, receipts, trial-ending and renewal reminders, deletion confirmations, and support replies. Legal basis: performance of our contract with you, and our legitimate interests in keeping you informed about your account.

Study notifications. Sending study reminders, streak and weekly summaries, Coach tips and exam reminders, level-ups, and “your material is ready” notices, which you can switch off. Legal basis: performance of our contract with you.

Customer support. Answering your questions, investigating problems, and running the ClassBot help assistant. Legal basis: performance of our contract with you, and our legitimate interests in helping visitors and users.

Product analytics and improvement. Understanding how the Services are used so we can fix problems and improve them. Legal basis: in the EEA and UK, your consent; elsewhere, our legitimate interests in improving the Services, with the ability to opt out (in the United States, analytics is on by default and you can turn it off).

Advertising measurement. Measuring which of our ads bring people to ClassFactor and helping advertising platforms show our ads to people likely to be interested. Legal basis: in the EEA and UK, your consent. In the United States, you can opt out at any time. Everywhere outside the United States, it stays off until you opt in.

Marketing emails. Sending newsletters and news about ClassFactor. Legal basis: in the EEA and UK, and wherever the law requires it, your consent; elsewhere, our legitimate interests in telling account holders and people who asked for updates about our product, with an unsubscribe link in every email.

Moderation, legal compliance, and claims. Reviewing reports, enforcing our Terms, responding to lawful requests, and establishing, exercising, or defending legal claims. Legal basis: compliance with legal obligations, and our legitimate interests in protecting our users, the public, and ClassFactor.

Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object as described in “Privacy rights in the EEA and UK”. Where we rely on consent, you can withdraw it at any time without affecting processing that happened before.

We may create aggregated or de-identified information that no longer identifies you, and use it to understand and improve the Services. We will not try to re-identify it.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects. Features like review scheduling, mastery estimates, and Coach tips are study recommendations based on your study activity, and you are always free to ignore them.

AI is at the heart of ClassFactor, so we want to be specific about how it handles your content. When you use an AI feature, we send the parts of your content needed for that feature to one of our AI providers, which processes it on our behalf and returns the result. All of these providers are used under paid, commercial API agreements.

OpenAI. Used for generating study material, the AI tutor and Study Coach, explanations, titles, and embeddings (which help us find relevant passages in your material); for transcribing audio and video you upload or record; for voice calls with the AI tutor; and for generating images used as lesson figures. For these features, OpenAI receives the relevant study content and prompts and, for the Coach, the context from your Study Coach profile that the reply needs.

Anthropic. Used for generating notes, lessons, and other study material, for the AI tutor and Study Coach on the Pro plan, and as a backup provider. Anthropic receives the relevant study content and prompts.

Google Gemini. Used to transcribe YouTube videos you add, to recognize text in images and PDF pages, and to detect labels for image-occlusion cards. Google receives the YouTube link or the images and pages involved.

ElevenLabs. Used to turn text into speech for the Listen read-aloud feature. ElevenLabs receives the text you ask to hear. To save time and cost, we may store the generated audio and play the same file again when exactly the same text is requested, including by another user.

Failover. If one provider is unavailable, a request may be sent to a different provider — for example from OpenAI to Anthropic, or the other way around — so your task can still be completed.

Voice calls. During a voice call with the AI tutor, audio from your microphone is streamed from your device directly to OpenAI; it does not pass through our servers. OpenAI transcribes your speech so the tutor can respond, and we receive and store the transcript. The call only uses your microphone while the call is open.

No training on your content. Under these providers’ commercial API terms, they do not use content submitted through their APIs to train their models. They may keep it for a limited period, typically up to 30 days, to monitor for abuse and misuse, after which it is deleted under their own policies. We do not use your study content to train our own AI models.

Human review. Our staff do not routinely read your study content or AI conversations. A person may review specific content when you report something or someone reports your shared content, when you ask our support team for help with it, or when it is necessary to investigate a security, safety, or legal issue.

Accuracy. AI-generated material can be wrong, incomplete, or out of date. It is a study aid, not professional advice, and you should check anything that matters. Our Terms of Service (/terms) explain this in more detail.

To keep ClassFactor safe, we combine safety instructions in our AI prompts, the safety systems built into our AI providers, and reports from users. You can report an AI Coach reply, content shared through a public link, or a display name you see on the leaderboard. Every report is reviewed by a person.

When we review a report, we look at the reported content and the information needed to decide on it, such as the account that created it. We may remove or disable content, change a display name, revoke a share link, or restrict or suspend an account. We keep records of reports and the decisions we make so we can enforce our policies consistently.

We may also remove or disable access to content where it violates our Terms of Service (/terms), infringes someone else’s rights, creates legal or security risk, or where the law requires it. We will try to tell you when we do this, unless the law, a security concern, or the risk of further harm prevents it.

ClassFactor is not a backup service. Please keep your own copies of anything important; you can download your data at any time from Settings → Your data.

We share personal data only in the ways described below.

Service providers. We use other companies to host and run the Services, and they process personal data on our behalf, under contracts that require them to protect it and use it only to provide their services to us. They fall into these categories: hosting, databases, and job queues (Railway); website hosting and content delivery (Vercel); file storage and bot protection (Cloudflare); AI processing (OpenAI, Anthropic, Google Gemini, and ElevenLabs, as described above); payment processing (Stripe); push notification delivery and app updates (Expo, Apple, and Google); email delivery (Resend); error monitoring (Sentry); product analytics (Google Analytics and Firebase); and fetching details of YouTube links you add (YouTube). The full list, with what each provider receives and where it processes data, is on our service providers page (/subprocessors).

Payment and app store providers. When you pay on the web, Stripe processes your payment and is responsible for your payment details. When you subscribe in our iOS or Android app, Apple or Google processes the payment, holds your payment details, and handles renewals, cancellations, and refunds under their own terms and privacy policies. We share with them what is needed to complete and verify your purchase, such as your email address and account identifiers.

Sign-in providers. If you sign in with Google or Apple, those companies know that you used their sign-in to access ClassFactor.

Advertising partners. Our website and web app use advertising pixels from Meta (Facebook and Instagram) and TikTok. When allowed, these pixels set cookies and tell the platform about visits to our pages, so we can measure which ads bring people to ClassFactor and so the platforms can show our ads to people likely to be interested.

We also send two kinds of events directly from our servers to Meta (through its Conversions API) and TikTok (through its Events API): when a free trial starts and when a subscription payment succeeds. We do this because a trial may convert to a paid subscription days after the visit that led to it, when no browser is involved. Each event contains the event type, an event identifier, the plan and amount, and the identifiers that let the platform match it to its own ad click: the advertising click identifiers and pixel cookie values we stored, the IP address and browser description recorded when you signed up, and your email address in hashed form (converted with a one-way function so the platform can match it to an existing account on its side, but the address itself is not sent). We send these events only if the advertising choice recorded with your account allows it.

Advertising partners never receive your study content — not your uploads, generated material, AI conversations, scores, or anything about what you are studying. Meta and TikTok may combine the information they receive with other information they hold, under their own privacy policies. This counts as “sharing” for cross-context behavioral advertising under California law and “targeted advertising” under other US state laws, even though we are not paid for it. How to turn it off is described in “Your advertising choices”.

Other users and the public. Some things you do are visible to others by design. If you appear on the leaderboard, other learners can see your alias and your standing — you can hide yourself from the leaderboard in Settings. If you create a public share link for a deck, quiz, note, or lesson, anyone with the link can view that content; you can revoke the link at any time, after which it stops working.

Legal requirements and safety. We may disclose personal data if we believe in good faith that it is required by law, subpoena, court order, or other legal process, or that it is reasonably necessary to enforce our Terms, to investigate fraud, security issues, or abuse, or to protect the rights, property, or safety of our users, the public, or ClassFactor. Where the law allows, we will try to tell you about a request for your data.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, personal data may be transferred as part of that transaction. The recipient will be required to honor this policy for the data it receives, and we will notify you of any change in who controls your data.

With your consent or at your direction. We share personal data in other ways when you ask us to or agree to it.

We do not sell personal data for money. We do not knowingly sell or share the personal data of anyone we know is under 16.

You can turn advertising off at any time using the “Your privacy choices” controls on our Cookie Policy page (/cookies), which you can also reach from the “Your privacy choices” link in the footer of our website. Turning advertising off is our “Do Not Sell or Share My Personal Information” opt-out under California law and our opt-out of targeted advertising under other US state laws. The same controls let you turn analytics on or off separately.

What happens before you choose depends on where you are. We use your IP address to detect your country. If you are in the United States, analytics and advertising are on by default and you can turn them off. Everywhere else — including the EEA, the UK, Switzerland, Canada, and Australia, and whenever we cannot tell where you are — analytics and advertising stay off until you opt in.

We honor Global Privacy Control (GPC). If your browser sends a GPC signal, we turn off both analytics and advertising before they load, wherever you are, and treat the signal as a valid request to opt out of sale and sharing.

Your choice is stored in a cookie on the classfactor.com domain, so one choice applies to both www.classfactor.com and app.classfactor.com in that browser. If you clear your cookies or use another browser or device, you will need to set your choice again there, unless your browser sends a GPC signal.

When you opt out, the advertising pixels stop loading. If you are signed in to the web app when you change your choice, we also update the advertising choice recorded with your account, and we stop sending server-side trial and purchase events for your account. Because those events do not depend on cookies, blocking cookies in your browser settings alone will not stop them — use the controls described above.

Opting out does not change what ClassFactor does for you. Your account, study content, and plan stay exactly the same, and you may still see ClassFactor ads that are not based on your activity.

We do not sell or share, for cross-context behavioral advertising, the personal data of users we know are under 16.

Marketing emails. If you are in the EEA or the UK, or anywhere else consent is required, we send you newsletters and marketing emails only if you have opted in. Elsewhere, we may send marketing emails to account holders and to people who asked to hear from us, and you can opt out at any time. Every marketing email includes an unsubscribe link and our postal address.

Service emails. Even if you unsubscribe from marketing, we will still send emails you need about your account and our Services, such as email verification, security alerts, receipts, trial-ending and renewal reminders, account deletion confirmations, and replies to your support requests.

Study notifications. Study reminders, weekly summaries, Coach tips, and “your material is ready” notices can be turned on or off in the notification settings in the app.

Push notifications. We send push notifications only if you allow them on your device. They may include study reminders, streak reminders, Coach tips and exam reminders, level-ups, and notices that generated material is ready. You can turn them off in the app’s settings or in your device settings; turning them off in your device settings stops all push notifications from ClassFactor.

We keep your account information, study content, study activity, and AI conversations for as long as your account is active, because they are what the Services are for. We do not currently delete inactive accounts automatically. You can delete individual items, such as uploads, decks, quizzes, notes, and conversations, at any time.

Archived Study Coach conversations are permanently deleted 30 days after you archive them.

Deleting your account. You can delete your account in Settings → Your data, on the web or in our apps. For your protection, we email you a confirmation link, which is valid for one hour. When you confirm, we permanently delete your account and the data linked to it, including your profile, study content, generated material, study activity, AI conversations, Study Coach profile, sessions, attribution data, push tokens, and subscription records linked to your account. We remove your uploaded files and generated media from storage, and we cancel any active subscription you bought on our website. Deletion cannot be undone, so download anything you want to keep first.

App store subscriptions. Deleting your account does not cancel a subscription you bought through the Apple App Store or Google Play. You need to cancel it in your Apple or Google account settings to stop future charges.

What we keep after deletion. We keep some records after an account is deleted, in a form that is no longer linked to your account, where we need them for legal, tax, accounting, or fraud-prevention reasons: payment and billing transaction records, and records of AI usage and cost. We keep these for as long as the law requires, generally up to seven years. We also keep records of reports and moderation decisions where needed to enforce our policies, security and audit logs, and messages our support staff wrote to you.

Backups and logs. Deleted data may remain in our encrypted database backups for up to 30 days before those backups are overwritten. Server logs are kept for a limited period for security and troubleshooting and then deleted.

Other records. Stripe, Apple, and Google keep their own records of payments you made through them, under their own legal obligations and privacy policies.

Download your data. In Settings → Your data, choose “Export your data” to download a copy of your account, content, and activity as a single JSON file.

Delete your account. In Settings → Your data, choose “Delete account”, then confirm using the link we email you.

Update your details. You can change your name, avatar, time zone, content language, and other account details in Settings.

Notifications. Turn study notifications on or off in the app’s notification settings, and turn push notifications off in your device settings.

Leaderboard. Change your alias or hide yourself from the leaderboard in Settings, and block or report other learners from the leaderboard.

Share links. Revoke any public share link you have created, and it will stop working.

Analytics and advertising. Change your choices at any time using the “Your privacy choices” controls on our Cookie Policy page (/cookies). In the mobile apps, you can change your analytics choice in the app.

Marketing emails. Use the unsubscribe link in any marketing email.

If you cannot find a control you need, email support@classfactor.com and we will help.

We use technical and organizational measures designed to protect personal data, including: encryption of data in transit using TLS; encryption of stored data at rest by our hosting providers; hashed passwords; private file storage that can only be accessed through short-lived signed links; access controls that limit staff access, with role-based administrator permissions and audit logging; rate limiting and bot protection; verification of app store purchases and signed payment notifications; and removal of one-time tokens from error reports.

No system is completely secure, and we cannot guarantee that personal data will never be accessed, disclosed, altered, or destroyed without authorization. You can help by using a strong, unique password, keeping your devices up to date, and telling us promptly if you think your account has been accessed without your permission.

If a security incident affects your personal data, we will notify you and the relevant authorities where the law requires us to.

To report a security vulnerability or a concern about your account, email support@classfactor.com.

You must be at least 13 years old to use ClassFactor. If you are in the EEA or the UK and under 16, you may use ClassFactor only with the consent of a parent or guardian. If you are under the age of majority where you live, a parent or guardian should review this policy and our Terms with you.

ClassFactor is not directed to children under 13, and we do not knowingly collect personal data from children under 13. For this reason, the Children’s Online Privacy Protection Act (COPPA) consent process does not apply to our Services. If we learn that an account belongs to a child under 13, we delete the account and its data.

If you are a parent or guardian and believe your child under 13 has created an account or given us personal data, email support@classfactor.com with enough information for us to find the account, and we will delete it.

We do not offer school or institutional accounts, and children under 13 cannot get access to ClassFactor through a school, teacher, or other organization. The “My Classes” feature is a personal way for learners to organize their own material.

We do not knowingly sell personal data of, or share it for cross-context behavioral advertising about, anyone under 16.

ClassFactor is based in the United States, and we and most of our service providers process and store personal data in the United States. Some providers, such as our website hosting and file storage providers, operate global networks that may process data in other countries, and TikTok may process data in the United States or Singapore.

If you are in the EEA, the UK, or Switzerland, your personal data will be transferred to countries whose data protection laws may differ from yours. When we transfer personal data out of those regions, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, and, where a provider is certified, the EU-U.S. Data Privacy Framework and its UK Extension. You can ask us for more information about these safeguards by emailing support@classfactor.com.

If you are in the EEA or the UK, the General Data Protection Regulation (GDPR) or UK GDPR gives you the following rights over your personal data, subject to certain exceptions.

(a) Access: to ask whether we process your personal data and to get a copy of it.

(b) Rectification: to have inaccurate or incomplete personal data corrected.

(c) Erasure: to have your personal data deleted.

(d) Restriction: to ask us to limit how we use your personal data, for example while a dispute about its accuracy is resolved.

(e) Portability: to receive personal data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another company where technically feasible.

(f) Objection: to object to processing based on our legitimate interests, and to object at any time to the use of your personal data for direct marketing.

(g) Withdrawal of consent: where we rely on your consent, to withdraw it at any time, without affecting processing that happened before.

How to exercise your rights. You can download your data and delete your account yourself in Settings → Your data. For any other request, email support@classfactor.com from the email address on your account, or tell us enough to identify you if you do not have an account. We may ask for information to verify your identity before acting on your request. We will respond within one month; if your request is complex or we receive many requests, we may extend this by up to two further months and will tell you why.

Complaints. If you have concerns, please contact us first so we can try to resolve them. You also have the right to lodge a complaint with a data protection supervisory authority — in the EEA, the authority in the country where you live, work, or where the issue occurred; in the UK, the Information Commissioner’s Office (ICO).

This section applies to California residents and supplements the rest of this policy. It is our notice at collection and describes our practices under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). The categories below cover the 12 months before the date at the top of this policy, and our current practices.

Categories of personal information we collect. (a) Identifiers, such as your name, email address, account ID, IP address, push tokens, advertising click identifiers, and identifiers from Google or Apple sign-in. (b) Customer records, such as your name, email address, and billing records. (c) Commercial information, such as your plan, subscription and purchase history, and credit purchases. (d) Internet or other electronic network activity, such as how you use the Services, pages viewed, device and browser information, and campaign attribution data. (e) Geolocation data, limited to the approximate country derived from your IP address; we do not collect precise location. (f) Audio or electronic information, such as audio and video you upload or record and the transcripts of voice calls. (g) Education-related information you choose to include in your study content, onboarding answers, or Study Coach profile, such as what you are studying and your goals. (h) Inferences, limited to study recommendations based on your study activity, such as mastery estimates, review schedules, and Coach tips; we do not create profiles about your characteristics. (i) Sensitive personal information, limited to your account login credentials (your email address combined with your password).

Sources. We collect personal information from you directly; automatically from your devices and browsers when you use the Services; from Google or Apple when you sign in with them; from Stripe, Apple, and Google about your purchases; and from friends who invite you.

Purposes. We collect and use personal information for the business purposes described in “How we use personal data, and our legal bases”: to provide the Services and the AI features you request, process payments, communicate with you, provide support, keep the Services secure and prevent fraud and abuse, analyze and improve the Services, measure our advertising, send marketing where permitted, moderate content, and comply with the law.

Disclosures for business purposes. In the past 12 months we disclosed each category of personal information listed above, other than sensitive personal information, to our service providers (such as hosting, storage, AI, payment, email, push notification, error monitoring, and analytics providers) to help us run the Services. We also disclosed identifiers, customer records, and commercial information to Stripe, Apple, and Google to process purchases. We may disclose any category where required by law or in a business transfer. We disclose account login credentials only to the service providers that host our authentication and database systems.

Sale and sharing. We do not sell personal information for money. In the past 12 months we have “shared” the following categories with Meta and TikTok for cross-context behavioral advertising, through the pixels on our website and web app and the server-side trial and purchase events described in “How we share personal data”: identifiers (such as cookie and advertising click identifiers, IP address, and hashed email address), internet or other electronic network activity (such as the pages you visited and your browser description), and commercial information (that a trial started or a payment succeeded, with the plan and amount). Under the CCPA’s broad definition, making this information available to advertising platforms may also be considered a “sale”, and we treat your opt-out as covering both. We do not sell or share sensitive personal information, and we do not knowingly sell or share the personal information of consumers under 16.

Retention. We keep each category of personal information for as long as described in “How long we keep personal data”: generally, for as long as your account is active, then deleted when you delete your account, except for de-identified billing and AI usage records kept as long as the law requires (generally up to seven years), moderation and security records, and backups kept for up to 30 days.

Your rights. If you are a California resident, you have the right to: (a) know what personal information we have collected about you, including the categories of personal information, sources, purposes, and the categories of third parties we disclose it to, and to receive the specific pieces of personal information we hold about you; (b) delete personal information we have collected from you, subject to exceptions allowed by law; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of your personal information; (e) limit the use and disclosure of your sensitive personal information; and (f) not be discriminated against for exercising these rights.

Opting out of sale and sharing. Use the “Your privacy choices” link in our website footer, which takes you to the controls on our Cookie Policy page (/cookies), and turn advertising off. We also treat a Global Privacy Control signal from your browser as a valid opt-out. If you prefer, email support@classfactor.com and we will help.

Sensitive personal information. We use your account login credentials only to let you sign in and keep your account secure, which are uses permitted by the CCPA without offering a right to limit. We do not use or disclose sensitive personal information to infer characteristics about you.

Submitting other requests. You can download your data and delete your account yourself in Settings → Your data. To make any other request, email support@classfactor.com. We verify requests by matching them to the email address on your ClassFactor account, for example by asking you to write from that address or to confirm a message we send to it; for more sensitive requests we may ask for additional information, which we use only to verify you. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, we may extend this by up to another 45 days and will tell you why.

Authorized agents. You may use an authorized agent to make a request for you. We will ask the agent for proof that you gave them signed permission, and we may ask you to verify your identity directly with us and confirm that you authorized the agent, unless the agent holds a valid power of attorney under California law.

Non-discrimination. We will not deny you the Services, charge you a different price, give you a different level or quality of service, or otherwise penalize you for exercising your privacy rights.

Notice of financial incentive. Our referral program gives you and the friend you invite Pro time when your friend signs up, under the terms shown in the app. To take part, you give us your friend’s email address (or share your referral link), and we collect your referral code, the fact that the referral happened, and whether it qualifies for a reward. We offer this program because referrals help ClassFactor grow; we estimate the value of the personal information involved as roughly equal to the value of the reward, based on what it costs us to attract a new user in other ways. Participation is optional, you opt in by sending an invitation or sharing your link, and you can stop at any time by no longer sending invitations or sharing your link. Rewards obtained through abuse, such as self-referral, may be voided.

Residents of states with comprehensive privacy laws — including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — have rights similar to those described for California residents, depending on the state and subject to the exceptions in its law.

These rights generally include the right to confirm whether we process your personal data and to access it; to correct inaccuracies; to delete your personal data; to get a portable copy of it; and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.

We do not sell personal data for money, and we do not engage in profiling that produces legal or similarly significant effects. We do process personal data for targeted advertising through the Meta and TikTok measurement described in “How we share personal data”. You can opt out using the “Your privacy choices” controls on our Cookie Policy page (/cookies), and we honor Global Privacy Control as a valid opt-out signal. We process sensitive data only with consent where the law requires it, and we do not knowingly process the personal data of anyone under 16 for targeted advertising.

To exercise your rights, use Settings → Your data or email support@classfactor.com. We verify requests as described in the California section and respond within the time your state’s law requires, generally 45 days, which may be extended where the law allows.

Appeals. If we decline to take action on your request, we will explain why. You can appeal by replying to our response or emailing support@classfactor.com with the subject line “Privacy request appeal”. We will respond to your appeal in writing within the time your state’s law requires, generally 45 or 60 days. If we deny your appeal, you can contact your state’s attorney general to submit a complaint.

Nevada residents. We do not sell covered information as defined under Nevada law. If you are a Nevada resident and want to send us an opt-out request anyway, email support@classfactor.com.

Do Not Track. Some browsers offer a “Do Not Track” setting. There is no agreed standard for how websites should respond to it, so we do not respond to Do Not Track signals. We do honor Global Privacy Control, as described in “Your advertising choices”.

Our iOS and Android apps collect the personal data described in this policy. The privacy disclosures in our Apple App Store listing and Google Play Data safety section are intended to match this policy. If you notice a difference, please tell us at support@classfactor.com so we can fix it.

Device permissions. Our apps ask for permission before using the following, and every permission is optional. Microphone: to record lectures or other audio you want to study from and to talk to the AI tutor in a voice call. Photo library: to select images of notes, slides, or textbook pages to import. Notifications: to send the notifications you choose. Bluetooth connection (Android 12 and later): to use a Bluetooth headset during voice calls. If you decline a permission, only the related feature is unavailable. You can change permissions at any time in your device settings.

Our apps do not use your device’s camera, precise location, or contacts, and they do not access your microphone or photo library in the background.

Push notifications. If you allow notifications, Apple or Google gives your device a push token. We store it with your device model and operating system and use it only to deliver ClassFactor notifications, relayed through Expo and Apple’s or Google’s push services. We do not use push tokens for advertising.

Analytics. Firebase Analytics in our apps is switched off until you agree to analytics in the app, and you can change that choice later.

No advertising identifiers or tracking. Our apps do not collect Apple’s Identifier for Advertisers (IDFA) or Google’s Advertising ID, show no ads, and do not track you across other companies’ apps or websites, so they do not show Apple’s App Tracking Transparency prompt. This statement is about the apps: our website and web app do use advertising cookies where allowed, as described in this policy.

Sign-in and storage. You can sign in with email and password, Google, or Sign in with Apple. The apps keep your sign-in token and app preferences in your device’s secure storage.

App updates. Our apps may download updates through Expo’s update service, which receives basic information about your app version and device to deliver the right update.

Purchases in the apps. Subscriptions bought in our iOS app are processed by Apple, and in our Android app by Google Play. Apple or Google takes the payment and manages renewals, cancellations, and refunds. We receive and verify transaction or purchase identifiers and status notifications so we can unlock your plan.

Account deletion. You can delete your account and its data inside the app in Settings → Your data, as well as on the web. Uninstalling the app does not delete your account. Deleting your account does not cancel an App Store or Google Play subscription; cancel it in your store account.

We use cookies and similar technologies such as local storage on our website and web app. Strictly necessary cookies keep you signed in, remember your privacy choices, protect our forms and checkout from bots and fraud, and are always on. Analytics cookies (Google Analytics) help us understand how the Services are used. Advertising cookies (Meta and TikTok) measure our advertising.

In the United States, analytics and advertising are on by default and you can turn them off. Everywhere else, they stay off until you opt in. A Global Privacy Control signal turns both off.

Our Cookie Policy (/cookies) lists every cookie and storage item we use, explains how long each lasts, and includes the “Your privacy choices” controls where you can change your choices at any time.

We may update this policy from time to time, for example when we change the Services or when the law changes. When we do, we will update the date at the top of this page.

If we make a material change — such as collecting a new category of personal data, using it for a new purpose, or sharing it with a new category of recipient — we will tell you before the change takes effect, by email to the address on your account, by a notice in the Services, or both. Where the law requires your consent to a change, we will ask for it.

This version of the policy is effective as of September 17, 2026.

If you have questions about this policy or how we handle your personal data, or want to exercise your privacy rights, contact us at support@classfactor.com.

Postal address: First Capital Merchant Solutions, Inc. d/b/a ClassFactor, 10001 NW 50th St, Ste 114, Sunrise, FL 33351-8087, USA.